Re: Attack research on HTTP/2 implementations

On 7/08/21 3:04 am, Mike Bishop wrote:
> :authority isn’t included in the list because it’s slightly different – 
> it’s not mandatory.  So the others must occur exactly once (which is 
> stated), while :authority must occur no more than once (which isn’t).
> 

The lack of "exactly one" for :authority has always given me an odd 
feeling. This thread has just brought to my attention the detail that 
may be behind that.

The requirement to provide :scheme without a requirement to provide 
:authority conflicts with the RFC3986 requirement that URLs containing 
scheme MUST also contain an authority section.


Are we at the stage of HTTP compliance yet where :authority can be 
promoted to SHOULD send (or if we want to go all the way MUST), with 
Host downgraded to SHOULD NOT when :authority is present?

Amos

Received on Saturday, 7 August 2021 09:34:33 UTC